Question Intermittent, short freezes. Possibly related to event id 4624, 4672 and 4798?

[cattecattecatte]

Hello all. I've made an account here to try and get some help with an intermittent performance issue I've been having. Nothing too severe, but its often enough that its starting to become a little more than irritating.

I've been having strange 'skips' happening on my setup. For instance, I'll be watching a video, and I'll hear the audio pop or skip for a brief second. I also want to say that I've noticed my mouse cursor freeze in that same instant, but I'm unsure if this happens every time I hear that audio skip. It's definitely much more noticeable if I'm playing a game, where the framerate will stop and then skip forward.

I've been actively trying to tracking this problem for a week now and I've picked up on some entries in the event viewer that seem to coincide at the exact moment with these hiccups. The most common ones are the event ID 4624, 4672 and 4798.

EVENT ID: 4624

• DESCRIPTION
An account was successfully logged on.

Subject:
Security ID: S-1-5-18
Account Name: WORLD-MACHINE$
Account Domain: WORKGROUP
Logon ID: 0x3E7

Logon Information:
Logon Type: 5
Restricted Admin Mode: -
Virtual Account: No
Elevated Token: Yes

Impersonation Level: Impersonation

New Logon:
Security ID: S-1-5-18
Account Name: SYSTEM
Account Domain: NT AUTHORITY
Logon ID: 0x3E7
Linked Logon ID: 0x0
Network Account Name: -
Network Account Domain: -
Logon GUID: {00000000-0000-0000-0000-000000000000}

Process Information:
Process ID: 0x3dc
Process Name: C:\Windows\System32\services.exe

Network Information:
Workstation Name: -
Source Network Address: -
Source Port: -

Detailed Authentication Information:
Logon Process: Advapi
Authentication Package: Negotiate
Transited Services: -
Package Name (NTLM only): -
Key Length: 0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The impersonation level field indicates the extent to which a process in the logon session can impersonate.

The authentication information fields provide detailed information about this specific logon request.
- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
• XML
<?xml version="1.0" encoding="utf-16"?>
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" />
<EventID>4624</EventID>
<Version>2</Version>
<Level>0</Level>
<Task>12544</Task>
<TaskName xmlns="">Logon</TaskName>
<Opcode>0</Opcode>
<OpcodeName xmlns="">Info</OpcodeName>
<Keywords>0x8020000000000000</Keywords>
<KeywordsNames xmlns="">Audit Success</KeywordsNames>
<TimeCreated SystemTime="2021-09-27T17:43:36.5060142Z" />
<EventRecordID>190212</EventRecordID>
<Correlation ActivityID="{25f3933d-b302-0002-9293-f32502b3d701}" />
<Execution ProcessID="1008" ThreadID="23128" />
<Channel>Security</Channel>
<Computer>World-Machine</Computer>
<Security />
</System>
<EventData>
<Data Name="SubjectUserSid">S-1-5-18</Data>
<Data Name="SubjectUserName">WORLD-MACHINE$</Data>
<Data Name="SubjectDomainName">WORKGROUP</Data>
<Data Name="SubjectLogonId">0x3e7</Data>
<Data Name="TargetUserSid">S-1-5-18</Data>
<Data Name="TargetUserName">SYSTEM</Data>
<Data Name="TargetDomainName">NT AUTHORITY</Data>
<Data Name="TargetLogonId">0x3e7</Data>
<Data Name="LogonType">5</Data>
<Data Name="LogonProcessName">Advapi </Data>
<Data Name="AuthenticationPackageName">Negotiate</Data>
<Data Name="WorkstationName">-</Data>
<Data Name="LogonGuid">{00000000-0000-0000-0000-000000000000}</Data>
<Data Name="TransmittedServices">-</Data>
<Data Name="LmPackageName">-</Data>
<Data Name="KeyLength">0</Data>
<Data Name="ProcessId">0x3dc</Data>
<Data Name="ProcessName">C:\Windows\System32\services.exe</Data>
<Data Name="IpAddress">-</Data>
<Data Name="IpPort">-</Data>
<Data Name="ImpersonationLevel">%%1833</Data>
<Data Name="RestrictedAdminMode">-</Data>
<Data Name="TargetOutboundUserName">-</Data>
<Data Name="TargetOutboundDomainName">-</Data>
<Data Name="VirtualAccount">%%1843</Data>
<Data Name="TargetLinkedLogonId">0x0</Data>
<Data Name="ElevatedToken">%%1842</Data>
</EventData>
</Event>

EVENT ID: 4672

• DESCRIPTION
Special privileges assigned to new logon.

Subject:
Security ID: S-1-5-18
Account Name: SYSTEM
Account Domain: NT AUTHORITY
Logon ID: 0x3E7

Privileges: SeAssignPrimaryTokenPrivilege
SeTcbPrivilege
SeSecurityPrivilege
SeTakeOwnershipPrivilege
SeLoadDriverPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeDebugPrivilege
SeAuditPrivilege
SeSystemEnvironmentPrivilege
SeImpersonatePrivilege
SeDelegateSessionUserImpersonatePrivilege
• XML
<?xml version="1.0" encoding="utf-16"?>
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" />
<EventID>4672</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>12548</Task>
<TaskName xmlns="">Special Logon</TaskName>
<Opcode>0</Opcode>
<OpcodeName xmlns="">Info</OpcodeName>
<Keywords>0x8020000000000000</Keywords>
<KeywordsNames xmlns="">Audit Success</KeywordsNames>
<TimeCreated SystemTime="2021-09-27T17:43:36.5060278Z" />
<EventRecordID>190213</EventRecordID>
<Correlation ActivityID="{25f3933d-b302-0002-9293-f32502b3d701}" />
<Execution ProcessID="1008" ThreadID="23128" />
<Channel>Security</Channel>
<Computer>World-Machine</Computer>
<Security />
</System>
<EventData>
<Data Name="SubjectUserSid">S-1-5-18</Data>
<Data Name="SubjectUserName">SYSTEM</Data>
<Data Name="SubjectDomainName">NT AUTHORITY</Data>
<Data Name="SubjectLogonId">0x3e7</Data>
<Data Name="PrivilegeList">SeAssignPrimaryTokenPrivilege
SeTcbPrivilege
SeSecurityPrivilege
SeTakeOwnershipPrivilege
SeLoadDriverPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeDebugPrivilege
SeAuditPrivilege
SeSystemEnvironmentPrivilege
SeImpersonatePrivilege
SeDelegateSessionUserImpersonatePrivilege</Data>
</EventData>
</Event>

EVENT ID: 4798

• DESCRIPTION
A user's local group membership was enumerated.

Subject:
Security ID: S-1-5-18
Account Name: WORLD-MACHINE$
Account Domain: WORKGROUP
Logon ID: 0x3E7

User:
Security ID: S-1-5-21-546192265-3936121651-1416374932-500
Account Name: Administrator
Account Domain: WORLD-MACHINE

Process Information:
Process ID: 0x1404
Process Name: C:\Windows\System32\svchost.exe
• XML
<?xml version="1.0" encoding="utf-16"?>
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" />
<EventID>4798</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>13824</Task>
<TaskName xmlns="">User Account Management</TaskName>
<Opcode>0</Opcode>
<OpcodeName xmlns="">Info</OpcodeName>
<Keywords>0x8020000000000000</Keywords>
<KeywordsNames xmlns="">Audit Success</KeywordsNames>
<TimeCreated SystemTime="2021-09-27T17:43:36.5481546Z" />
<EventRecordID>190214</EventRecordID>
<Correlation ActivityID="{25f3933d-b302-0002-9293-f32502b3d701}" />
<Execution ProcessID="1008" ThreadID="23128" />
<Channel>Security</Channel>
<Computer>World-Machine</Computer>
<Security />
</System>
<EventData>
<Data Name="TargetUserName">Administrator</Data>
<Data Name="TargetDomainName">WORLD-MACHINE</Data>
<Data Name="TargetSid">S-1-5-21-546192265-3936121651-1416374932-500</Data>
<Data Name="SubjectUserSid">S-1-5-18</Data>
<Data Name="SubjectUserName">WORLD-MACHINE$</Data>
<Data Name="SubjectDomainName">WORKGROUP</Data>
<Data Name="SubjectLogonId">0x3e7</Data>
<Data Name="CallerProcessId">0x1404</Data>
<Data Name="CallerProcessName">C:\Windows\System32\svchost.exe</Data>
</EventData>
</Event>

The thing is, I've searched around a lot and from what I can tell, these are probably just typical windows operations? I'm not worried about being infected by a virus or that some foreign party is trying to logon to my system, but what concerns me is that these normal service audits are causing my computer to seize up, even if its an admittedly small and infrequent issue. I guess I just need help to rule out whether or not my hardware is bad. Speaking of, here are my system specs:

OS: Windows 10 Pro 64-Bit
CPU: AMD Ryzen 7 2700
RAM: 16GB
MB: ROG Crosshair viii hero (wifi)
GPU: NVIDIA geforce gtx 1070 Ti

This is my first time posting to one of these kinds of forums asking for tech support, so if there's any other information I can provide, please lemme know! Thanks a ton for any help.

Quick edit: I should also point out that these event ids occur all the time but don't always result in a skip, which makes the cause even more difficult to ascertain.

 

[Koekieezz]

Hello all. I've made an account here to try and get some help with an intermittent performance issue I've been having. Nothing too severe, but its often enough that its starting to become a little more than irritating.

I've been having strange 'skips' happening on my setup. For instance, I'll be watching a video, and I'll hear the audio pop or skip for a brief second. I also want to say that I've noticed my mouse cursor freeze in that same instant, but I'm unsure if this happens every time I hear that audio skip. It's definitely much more noticeable if I'm playing a game, where the framerate will stop and then skip forward.

I've been actively trying to tracking this problem for a week now and I've picked up on some entries in the event viewer that seem to coincide at the exact moment with these hiccups. The most common ones are the event ID 4624, 4672 and 4798.

EVENT ID: 4624


EVENT ID: 4672


EVENT ID: 4798


The thing is, I've searched around a lot and from what I can tell, these are probably just typical windows operations? I'm not worried about being infected by a virus or that some foreign party is trying to logon to my system, but what concerns me is that these normal service audits are causing my computer to seize up, even if its an admittedly small and infrequent issue. I guess I just need help to rule out whether or not my hardware is bad. Speaking of, here are my system specs:

OS: Windows 10 Pro 64-Bit
CPU: AMD Ryzen 7 2700
RAM: 16GB
MB: ROG Crosshair viii hero (wifi)
GPU: NVIDIA geforce gtx 1070 Ti

This is my first time posting to one of these kinds of forums asking for tech support, so if there's any other information I can provide, please lemme know! Thanks a ton for any help.

Quick edit: I should also point out that these event ids occur all the time but don't always result in a skip, which makes the cause even more difficult to ascertain.

try this step by step (read until end):

• Disconnect from internet
• Uninstall gpu driver DDU (clean and do not restart).
• Uninstall all the processors on device manager (should be 16 on yours, also when it asks for restart, click on no) like this:
  
  
• Restart the pc to bios, and update to the latest bios. Then go to bios again after update and load default or optimized settings.
  
  
• boot up to windows and install the latest AMD Chipset driver, reboot, go to power plan, choose amd ryzen balanced, and connect to internet.
  
  
• Install the latest nvidia driver.
  
  *do this all offline until reboot after installing chipset driver, also you may reboot to bios after all of this to set the XMP (and previous settings you did) and make sure ram is on slot 2 and 4 if you use 2 sticks. Download needed files (highlighted word) before doing step 1, do the step by orders.
  
  
• And check windows update (and optional updates) if there is any and install them (except chipset in optional update). Also enable Hardware Accelerated Graphics Scheduling (available on the latest win 10 update) in graphics settings like this and reboot:
  
  

Make sure the psu connected to the gpu is 1 pcie cable per 1 slot (use main cable, not the branches/split) like this:

 

[cattecattecatte]

thank you for the reply! I'm a little bit busy today, but I'll try and get all this done as soon as I can. I'll report back afterward and let you know how it goes!

 

[cattecattecatte]

Alright, I've just finished everything you suggested. I uninstalled and reinstalled the gpu and processor drivers while disconnected from the internet. My bios was actually very out of date too, so I'm glad I was able to update that. I was actually a little surprised to see that I had apparently already set my memory into the 2nd and 4th slot. and just like in your diagram, I have two power cables running into my gpu from the power supply.

Now all I have to do is wait to see if these skips come back. I'll report back soon!

 

[Koekieezz]

Alright, I've just finished everything you suggested. I uninstalled and reinstalled the gpu and processor drivers while disconnected from the internet. My bios was actually very out of date too, so I'm glad I was able to update that. I was actually a little surprised to see that I had apparently already set my memory into the 2nd and 4th slot. and just like in your diagram, I have two power cables running into my gpu from the power supply.

Now all I have to do is wait to see if these skips come back. I'll report back soon!

i hope all the best

I uninstalled and reinstalled the gpu and processor drivers while disconnected from the internet.

You did reinstall the gpu driver after the bios update and chipset driver right? kinda curious if you're doing step by step

Also you could defrag the ssd and hdd if you wanted to later, might help a bit (while not much in ssd but could give a try )

 

[cattecattecatte]

Yeah yeah, sorry for not clarifying, but I did go step by step. I only have 3 ssd's but I'll give each of them a defrag as well!

 

[cattecattecatte]

Dang, so I just had a skip while I was watching a video, the same sort of audio pop as before. I was working on an assignment as it happened so I didn't happen to catch the time that it happened at, but if I notice another one, I'll try an d see if anything happened at that same moment.

 

[Pacu]

Did you manage to fix this? I'm struggling with ID 4624, 4672 and 5379, but I have the same symptom as you.

 

[cattecattecatte]

Did you manage to fix this? I'm struggling with ID 4624, 4672 and 5379, but I have the same symptom as you.

Unfortunately, I wasn't able to. For the sake of my mental health I instead elected to ignore the problem hahah

 

[Pacu]

Unfortunately, I wasn't able to. For the sake of my mental health I instead elected to ignore the problem hahah

wow. I'll try my best, and update if I manage to solve it somehow.